Why did my mail merge bounce? Outlook NDR codes explained

Your mail merge came back with "Delivery has failed" and a 550 code. What 5.7.708 Access denied, 5.1.1 and other Outlook bounces mean and how to fix them.

Updated September 2026

Every bounce names the server that refused your message and a three-part code that says why. Find the code, match it in the table below, and follow the fix for that group. The recipient received nothing, and for any code starting with 5, Outlook will not retry.

How to read the bounce

Microsoft’s non-delivery report (NDR) looks like this. Names, domains and addresses below are made up; your own bounce follows the same layout.

Delivery has failed to these recipients or groups:

[email protected]
Your message couldn't be delivered because the recipient's email provider rejected it.

Diagnostic information for administrators:

Generating server: EXAMPLE-MB01.prod.outlook.com

[email protected]
Remote server returned '550 5.7.708 Service unavailable. Access denied,
traffic not accepted from this IP. For more information see
https://go.microsoft.com/fwlink/?linkid=526653'

Original message headers:

Authentication-Results: spf=pass (sender IP is 40.107.0.1)
 smtp.mailfrom=example.org; dkim=none (message not signed) header.d=none;
 dmarc=none action=none header.from=example.org;

Three lines carry the answer:

1. “Remote server returned” tells you who refused the message. “Remote server” means the recipient’s mail system said no. If that line is missing and the report only names your own generating server, the block happened inside your own Microsoft 365 tenant before the message left.
2. The code, for example 550 5.7.708. The first digit is the verdict: 5 is a permanent refusal, 4 is temporary and Outlook keeps retrying. The rest of the code, and the sentence after it, is what you look up in the table below.
3. Authentication-Results shows how your sending domain looked to the receiving server. dkim=none and dmarc=none mean the domain is not signed and has no DMARC policy. That is not the cause of a 5.7.708, but it decides how fast you recover from one, so note it now.

Which bounce did you get?

The sections below take each group in turn: what the code means, and what to change before the next send.

5.7.708: Access denied, traffic not accepted from this IP

This is the bounce behind most “access denied” searches, and it is the one that stops a whole mail merge rather than a single address.

What it means. The recipient’s Microsoft 365 tenant refused the connection from the IP address your message came from. A Microsoft 365 mailbox does not send from its own IP. Microsoft routes outbound mail through shared pools, and when the pool or the sending tenant has a poor reputation, other Microsoft 365 tenants reject it at the door. Microsoft documents two triggers:

• A new or trial tenant. Microsoft states the block is “more likely to affect new customers, such as those who have a Microsoft 365 trial subscription”, and the remedy it names is to contact support for an exception until Exchange Online licenses are assigned.
• Spam-like traffic from the tenant. Microsoft lists 5.7.708 next to 5.7.705 with the explanation “Most of the traffic from this tenant is detected as suspicious”, which happens after a burst of bulk mail, a compromised mailbox or an open relay.

Established tenants also report the same bounce after one large send, when Microsoft moves their outbound mail to its high-risk delivery pool. That is not in the 5.7.708 article, but it fits the pattern: many messages in a short window, from a domain with dkim=none and dmarc=none, to a list that was not cleaned.

Fix it in this order

1. Stop the mail merge. Every further message deepens the reputation problem. In SecureMailMerge, stop the running mail merge, then check the Outbox in Outlook for queued messages.
2. Check for a restricted mailbox. An administrator opens the Microsoft Defender portal under Email and collaboration, Review, Restricted entities. A sender listed there is blocked tenant-wide until unblocked, and the same list catches compromised accounts.
3. Confirm the tenant is licensed. If the tenant is on a trial or the sending mailbox has no Exchange Online license, assign one. This is the only cause Microsoft names for new tenants.
4. Open a Microsoft support request. Paste the complete bounce, including the “Diagnostic information for administrators” section. Microsoft’s own guidance for 5.7.705 and 5.7.708 is to resolve any compromise first, then contact support. The delist portal at sender.office.com is for IP addresses you control and does not cover Microsoft’s shared outbound IPs.
5. Authenticate the domain. Publish SPF and DMARC records for the sending domain at your DNS host, and enable DKIM signing for the domain in the Microsoft Defender portal. Check the next bounce or a test message to yourself: the Authentication-Results header should read dkim=pass and dmarc=pass.
6. Wait. Reputation recovers over days, not hours. Sending again the same afternoon resets the clock.
7. Resume slowly. Remove every address that bounced with a 5.1.x or 5.4.1 code, then send in smaller daily batches with a delay between messages and a sending window, staying well under the Outlook sending limits.

The address does not exist

5.1.1, 5.1.10, 5.5.0 and 5.4.1 Recipient address rejected: Access denied all mean the same thing: the receiving server has no mailbox by that name. A spreadsheet that has not been used for a while produces these in bulk, and they are the most common bounce in any mail merge.

Remove the address from your list before the next send. Bounces of this kind are counted by receiving servers, and a high bounce rate is one of the signals that leads to the 5.7.708 block above. The email list cleaner finds typos, duplicates and malformed addresses in a spreadsheet before you send.

Your own tenant blocked the message

These codes come from your own Microsoft 365 tenant, so an administrator on your side can fix them without waiting on anyone else.

• 5.7.705 Access denied, tenant has exceeded threshold. Microsoft judged most of the tenant’s outbound mail suspicious and paused sending for the whole tenant. Same fix list as 5.7.708 above: resolve any compromise, then contact Microsoft support.
• 5.1.8 Access denied, bad outbound sender. One mailbox was blocked for sending what Microsoft classed as spam. Microsoft’s note says this “typically” follows a compromised account, but a large unsolicited send trips it too. Unblock the sender under Restricted entities in the Defender portal after confirming the mailbox is not compromised.
• 5.1.90 or 5.2.2 Submission quota exceeded. The mailbox reached the recipient rate limit of 10,000 recipients per rolling 24 hours or the message rate limit of 30 messages per minute. The block lifts on its own as the window moves. Set a daily cap and a delay in the add-in so the next send stays under the line; the sending limits article has the numbers.
• 5.7.750 Client blocked from sending from unregistered domains. The From address uses a domain that is not added and verified in the tenant. Add and verify the domain in the Microsoft 365 admin center, or send from an address on a verified domain.

The recipient does not accept mail from you

5.7.1 Delivery not authorized means the recipient exists but has a policy against your message: a distribution group that only accepts mail from members, or a transport rule at the recipient’s organization that rejects it. 5.7.1 Unable to relay means the address’s domain points at a server that does not accept mail for it. Neither is about your reputation. Remove the address, or ask the recipient to allow your sender.

Temporary failures: 4.x.x

A code starting with 4, such as 4.4.7 Message expired or 4.4.316 Connection refused, means the recipient’s server could not be reached or was too slow, and Outlook kept trying. You only receive a bounce for it once Exchange Online has given up, which Microsoft states happens after 24 hours of failed attempts. Nothing on your side needs fixing unless the same domain fails for every recipient, in which case their mail server is down or misconfigured.